Check ID: admincenter_users_between_two_and_four_global_admins
Provider: Microsoft 365
Service: admincenter
Severity: MEDIUM
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Count of users assigned the Global Administrator role in the Microsoft 365 tenant is between 2 and 4 (inclusive).

​
Risk

Having 1 Global Administrator jeopardizes availability if that account is unavailable or locked out. Having 5 expands the attack surface; one compromised admin can enable tenant-wide changes, data exfiltration, and privilege escalation, impacting confidentiality and integrity.

​
Recommendation

Maintain 2-4 standing Global Administrators (include two break-glass accounts). Apply least privilege using scoped roles and just-in-time elevation. Enforce MFA, run periodic access reviews, and implement separation of duties to limit standing privileged exposure.

​
Remediation

# Assign the Global Administrator role to a specific principal (user or group)
# Critical: Looks up the built-in Global Administrator role
data "azuread_directory_role" "global_admin" {
  display_name = "Global Administrator"
}

# Critical: Creates the role assignment so the principal becomes a Global Administrator
# This helps reach the recommended 2-4 Global Administrators
resource "azuread_directory_role_assignment" "<example_resource_name>" {
  role_id             = data.azuread_directory_role.global_admin.object_id  # Critical: GA role ID
  principal_object_id = "<example_resource_id>"                             # Critical: target user/group object ID
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = admincenter_users_between_two_and_four_global_admins. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks